PT-2020-7186

CVE-2012-1495

Published

2020-01-27

Updated

2020-01-29

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebCalendar versions prior to 1.2.5

Description The issue allows remote attackers to execute arbitrary code via the form single user login parameter in the install/index.php file.

Recommendations For versions prior to 1.2.5, update to version 1.2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the install/index.php file until a patch is applied. Avoid using the form single user login parameter in the affected file until the issue is resolved.

Exploitability

Exploit

Fix

Impacts

Researchers

Egidio Romano

Egix

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

Related identifiers